Technical Information
- [<HKLM>\System\CurrentControlSet\Services\Kxwtvr Cpyblk] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Kxwtvr Cpyblk] 'ImagePath' = '<SYSTEM32>\svchost.exe -k imgsvc'
- 'Kxwtvr Cpyblk' <SYSTEM32>\svchost.exe -k imgsvc
- C:\nettemp.ini
- %ProgramFiles(x86)%\internet explorer\termial.dll
- C:\nettemp.ini
- C:\nettemp.ini
- 'localhost':3771
- DNS ASK ss####5.codns.com
- '%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles(x86)%\Internet Explorer\termial.dll", Import